<!DOCTYPE html>
<html lang="en">
  <head>
    <link rel="stylesheet" type="text/css" href="/css/style.css?v=18" />
    <link rel="stylesheet" type="text/css" href="/css/fontello.css?v=2" />
    <link rel="stylesheet" type="text/css" href="/css/themes/nitter.css" />
    <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
    <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png" />
    <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
    <link rel="manifest" href="/site.webmanifest" />
    <link rel="mask-icon" href="/safari-pinned-tab.svg" color="#ff6c60" />
    <link rel="search" type="application/opensearchdescription+xml" title="nitter" href="https://nitter.net/opensearch" />
    <link rel="canonical" href="https://twitter.com/inversecos/status/1527188391347068928" />
    <title>inversecos (@inversecos): &quot;1\ #ThreatHunting: How to detect fileless Linux malware

Look for processes in &#x2F;proc&#x2F;&lt;PID&gt;&#x2F;exe where the path shows &quot;(deleted)&quot;

Here are two examples👇
1. BPFDoor deleted binary 
2. An attacker abusing memfd_create() to exec their malware in RAM w&#x2F;o dropping files to disk.&quot; | nitter</title>
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <meta name="theme-color" content="#1F1F1F" />
    <meta property="og:type" content="photo" />
    <meta property="og:title" content="inversecos (@inversecos)" />
    <meta property="og:description" content="1\ #ThreatHunting: How to detect fileless Linux malware

Look for processes in /proc/&lt;PID&gt;/exe where the path shows &quot;(deleted)&quot;

Here are two examples👇
1. BPFDoor deleted binary 
2. An attacker abusing memfd_create() to exec their malware in RAM w/o dropping files to disk." />
    <meta property="og:site_name" content="Nitter" />
    <meta property="og:locale" content="en_US" />
    <link rel="preload" type="image/png" href="/pic/media%2FFTGWap-acAIJ2oq.png%3Fname%3Dsmall" as="image" />
    <meta property="og:image" content="https://nitter.net/pic/media%2FFTGWap-acAIJ2oq.png" />
    <meta property="twitter:image:src" content="https://nitter.net/pic/media%2FFTGWap-acAIJ2oq.png" />
    <meta property="twitter:card" content="summary_large_image" />
    <link rel="preload" type="image/png" href="/pic/media%2FFTGWc15aQAAC9Ri.png%3Fname%3Dsmall" as="image" />
    <meta property="og:image" content="https://nitter.net/pic/media%2FFTGWc15aQAAC9Ri.png" />
    <meta property="twitter:image:src" content="https://nitter.net/pic/media%2FFTGWc15aQAAC9Ri.png" />
    <meta property="twitter:card" content="summary_large_image" />
    <link rel="preload" type="font/woff2" as="font" href="/fonts/fontello.woff2?21002321" crossorigin="anonymous" />
  </head>
  <body>
    <nav><div class="inner-nav">
        <div class="nav-item"><a class="site-name" href="/">nitter</a></div>
        <a href="/"><img class="site-logo" src="/logo.png" alt="Logo" /></a>
        <div class="nav-item right">
          <div class="icon-container"><a class="icon-search" title="Search" href="/search"></a></div>
          <div class="icon-container"><a class="icon-bird" title="Open in Twitter" href="https://twitter.com/inversecos/status/1527188391347068928"></a></div>
          <a href="https://liberapay.com/zedeus"><svg class="lp" viewBox="0 0 40.6 52.3">
  <g transform="matrix(0.83,0,0,0.83,-158,-261)">
    <path d="m202.5,366c-3.1 0-5.5-0.4-7.3-1.2-1.8-0.8-3-1.9-3.8-3.3-0.8-1.4-1.1-3-1.1-4.8 0-1.8 0.3-3.7 0.8-5.8l8.3-34.8 10.2-1.6-9.1 37.8c-0.2 0.8-0.3 1.5-0.3 2.2 0 0.7 0.1 1.2 0.4 1.7 0.3 0.5 0.7 0.9 1.3 1.2 0.6 0.3 1.5 0.5 2.7 0.6l-2 8.1"/>
    <path d="m239.2 344.3c0 3.2-0.5 6.1-1.6 8.8-1 2.6-2.5 4.9-4.4 6.9-1.9 1.9-4.1 3.4-6.7 4.5-2.6 1.1-5.4 1.6-8.5 1.6-1.5 0-3-0.1-4.5-0.4l-3 11.9h-9.7l10.9-45.4c1.7-0.5 3.7-1 6-1.4 2.3-0.4 4.7-0.6 7.3-0.6 2.4 0 4.6 0.4 6.3 1.1 1.8 0.7 3.2 1.8 4.4 3 1.1 1.3 2 2.8 2.5 4.5 0.5 1.7 0.8 3.6 0.8 5.5m-23.8 13.4c0.7 0.2 1.7 0.3 2.8 0.3 1.7 0 3.3-0.3 4.7-1 1.4-0.6 2.6-1.5 3.6-2.7 1-1.1 1.7-2.5 2.3-4.1 0.5-1.6 0.8-3.4 0.8-5.3 0-1.9-0.4-3.5-1.2-4.8-0.8-1.3-2.3-2-4.3-2-1.4 0-2.7 0.1-3.9 0.4l-4.6 19.1"/>
  </g>
</svg>
</a>
          <div class="icon-container"><a class="icon-info" title="About" href="/about"></a></div>
          <div class="icon-container"><a class="icon-cog" title="Preferences" href="/settings?referer=%2Finversecos%2Fstatus%2F1527188391347068928%23m"></a></div>
        </div>
      </div></nav>
    <div class="container"><div class="conversation">
        <div class="main-thread">
          <div id="m" class="main-tweet"><div class="timeline-item thread thread-line"><div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/inversecos"><img class="avatar round" src="/pic/profile_images%2F1437666905536430082%2F64FS5KZv_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/inversecos" title="inversecos">inversecos</a>
                        <a class="username" href="/inversecos" title="@inversecos">@inversecos</a>
                      </div>
                      <span class="tweet-date"><a href="/inversecos/status/1527188391347068928#m" title="May 19, 2022 · 7:24 AM UTC">May 19</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">1\ <a href="/search?q=%23ThreatHunting">#ThreatHunting</a>: How to detect fileless Linux malware

Look for processes in /proc/&lt;PID&gt;/exe where the path shows "(deleted)"

Here are two examples👇
1. BPFDoor deleted binary 
2. An attacker abusing memfd_create() to exec their malware in RAM w/o dropping files to disk.</div>
                <div class="attachments"><div class="gallery-row" style="">
                    <div class="attachment image"><a class="still-image" href="/pic/media%2FFTGWap-acAIJ2oq.png%3Fname%3Dorig" target="_blank"><img src="/pic/media%2FFTGWap-acAIJ2oq.png%3Fname%3Dsmall" alt="" /></a></div>
                    <div class="attachment image"><a class="still-image" href="/pic/media%2FFTGWc15aQAAC9Ri.png%3Fname%3Dorig" target="_blank"><img src="/pic/media%2FFTGWc15aQAAC9Ri.png%3Fname%3Dsmall" alt="" /></a></div>
                  </div></div>
                <p class="tweet-published">May 19, 2022 · 7:24 AM UTC · Twitter Web App</p>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 26</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 534</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span> 7</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 1,867</div></span>
                </div>
              </div></div></div>
          <div class="after-tweet thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/inversecos/status/1527188396720144385#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/inversecos"><img class="avatar round" src="/pic/profile_images%2F1437666905536430082%2F64FS5KZv_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/inversecos" title="inversecos">inversecos</a>
                        <a class="username" href="/inversecos" title="@inversecos">@inversecos</a>
                      </div>
                      <span class="tweet-date"><a href="/inversecos/status/1527188396720144385#m" title="May 19, 2022 · 7:24 AM UTC">May 19</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">2\ To recover/extract these binaries running in memory - you can copying them out from this location:

/proc/&lt;PID&gt;/exe

Also as an FYI for memfd_create() abuse detection you can hunt for the "memfd: (deleted)" string directly.</div>
                <div class="attachments"><div class="gallery-row" style=""><div class="attachment image"><a class="still-image" href="/pic/media%2FFTGNS-AaMAA59s7.jpg%3Fname%3Dorig" target="_blank"><img src="/pic/media%2FFTGNS-AaMAA59s7.jpg%3Fname%3Dsmall" alt="" /></a></div></div></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 4</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 9</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 75</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/inversecos/status/1527188401526812672#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/inversecos"><img class="avatar round" src="/pic/profile_images%2F1437666905536430082%2F64FS5KZv_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/inversecos" title="inversecos">inversecos</a>
                        <a class="username" href="/inversecos" title="@inversecos">@inversecos</a>
                      </div>
                      <span class="tweet-date"><a href="/inversecos/status/1527188401526812672#m" title="May 19, 2022 · 7:24 AM UTC">May 19</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">3\ You can also review what command line spawned the pid by reviewing:

/proc/&lt;PID&gt;/cmdline

This screenshot shows the cmdline used for the memdf_create() reverse shell. There are a lot of other interesting things you can also review in /proc/PID</div>
                <div class="attachments"><div class="gallery-row" style=""><div class="attachment image"><a class="still-image" href="/pic/media%2FFTGOT6CacAAJmNS.png%3Fname%3Dorig" target="_blank"><img src="/pic/media%2FFTGOT6CacAAJmNS.png%3Fname%3Dsmall" alt="" /></a></div></div></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 2</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 8</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 62</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item thread-last ">
              <a class="tweet-link" href="/inversecos/status/1527188403670106112#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/inversecos"><img class="avatar round" src="/pic/profile_images%2F1437666905536430082%2F64FS5KZv_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/inversecos" title="inversecos">inversecos</a>
                        <a class="username" href="/inversecos" title="@inversecos">@inversecos</a>
                      </div>
                      <span class="tweet-date"><a href="/inversecos/status/1527188403670106112#m" title="May 19, 2022 · 7:24 AM UTC">May 19</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">4\ Btw if you're interested in the memdf_create() technique if you're a redteamer/pentester check out this awesome presentation discussing this technique

<a href="https://2018.zeronights.ru/wp-content/uploads/materials/09-ELF-execution-in-Linux-RAM.pdf">2018.zeronights.ru/wp-conten…</a></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 13</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 104</div></span>
                </div>
              </div>
            </div>
          </div>
        </div>
        <div id="r" class="replies">
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/timb_machine/status/1527197392340242432#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/timb_machine"><img class="avatar round" src="/pic/profile_images%2F68168727%2F2007061702-debconf_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/timb_machine" title="Tim Brown">Tim Brown</a>
                        <a class="username" href="/timb_machine" title="@timb_machine">@timb_machine</a>
                      </div>
                      <span class="tweet-date"><a href="/timb_machine/status/1527197392340242432#m" title="May 19, 2022 · 8:00 AM UTC">May 19</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/inversecos">@inversecos</a> <a href="/ollieatnccgroup">@ollieatnccgroup</a></div>
                <div class="tweet-content media-body" dir="auto">One more for luck i/c detection analysis: <a href="https://gist.github.com/timb-machine/7bd75479ee29aee8762952ea16908eb0">gist.github.com/timb-machine…</a></div>
                <div class="card large"><a class="card-container" href="https://gist.github.com/timb-machine/7bd75479ee29aee8762952ea16908eb0">
                    <div class="card-image-container"><div class="card-image"><img src="/pic/card_img%2F1525616069339144192%2FkCX39qcf%3Fformat%3Dpng%26name%3D600x600" alt="" /></div></div>
                    <div class="card-content-container"><div class="card-content">
                        <h2 class="card-title">Fileless bash malware PoC</h2>
                        <p class="card-description">Fileless bash malware PoC. GitHub Gist: instantly share code, notes, and snippets.</p>
                        <span class="card-destination">gist.github.com</span>
                      </div></div>
                  </a></div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span> 2</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 20</div></span>
                </div>
              </div>
            </div></div>
          <div class="reply thread thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/agowa338/status/1527212239647801348#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/agowa338"><img class="avatar round" src="/pic/profile_images%2F1410078807718076418%2FcnY4fVJe_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/agowa338" title="Klaus Frank (@agowa338@chaos.social)">Klaus Frank (@agowa338@chaos.social)</a>
                        <a class="username" href="/agowa338" title="@agowa338">@agowa338</a>
                      </div>
                      <span class="tweet-date"><a href="/agowa338/status/1527212239647801348#m" title="May 19, 2022 · 8:59 AM UTC">May 19</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/inversecos">@inversecos</a></div>
                <div class="tweet-content media-body" dir="auto">&gt; Look for processes in /proc/&lt;PID&gt;/exe where the path shows "(deleted)"

This would also detect if an application has been updated but not yet restarted...</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 11</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item thread-last ">
              <a class="tweet-link" href="/cyb3rops/status/1527259048353181696#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/cyb3rops"><img class="avatar round" src="/pic/profile_images%2F1398178631806074880%2FfUAJnS7h_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/cyb3rops" title="Florian Roth ⚡️">Florian Roth ⚡️</a>
                        <a class="username" href="/cyb3rops" title="@cyb3rops">@cyb3rops</a>
                      </div>
                      <span class="tweet-date"><a href="/cyb3rops/status/1527259048353181696#m" title="May 19, 2022 · 12:05 PM UTC">21h</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">Yes. The typical false positives with that approach but still useful. It’s something that requires manual review by a forensic investigator.</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 12</div></span>
                </div>
              </div>
            </div>
          </div>
          <div class="reply thread thread-line">
            <div class="timeline-item ">
              <a class="tweet-link" href="/citypw/status/1527236197306748928#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/citypw"><img class="avatar round" src="/pic/profile_images%2F1114427441%2Fvampire-eyes-sm_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/citypw" title="Shawn C">Shawn C</a>
                        <a class="username" href="/citypw" title="@citypw">@citypw</a>
                      </div>
                      <span class="tweet-date"><a href="/citypw/status/1527236197306748928#m" title="May 19, 2022 · 10:34 AM UTC">23h</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/inversecos">@inversecos</a></div>
                <div class="tweet-content media-body" dir="auto">Should detect the attack and wage the prevention in the 1st place. Otherwise it'll fall into mouse and cat game.</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 1</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span></div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item ">
              <a class="tweet-link" href="/kyanha/status/1527242414192308225#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/kyanha"><img class="avatar round" src="/pic/abs.twimg.com%2Fsticky%2Fdefault_profile_images%2Fdefault_profile_bigger.png" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/kyanha" title="Kyle Hamilton">Kyle Hamilton</a>
                        <a class="username" href="/kyanha" title="@kyanha">@kyanha</a>
                      </div>
                      <span class="tweet-date"><a href="/kyanha/status/1527242414192308225#m" title="May 19, 2022 · 10:59 AM UTC">22h</a></span>
                    </div>
                  </div></div>
                <div class="tweet-content media-body" dir="auto">If someone attacks and spawns arbitrary code, you know you haven't succeeded at that first part yet. This is mitigating damage already done. ("should", yes. But "should" often does not reflect reality. What's the next step if "should" is treated as "shall", but is violated?)</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span> 2</div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span> 1</div></span>
                </div>
              </div>
            </div>
            <div class="timeline-item more-replies"><a class="more-replies-text" href="/kyanha/status/1527242414192308225#m">more replies</a></div>
          </div>
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/JulianVoeg/status/1527238698349346818#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/JulianVoeg"><img class="avatar round" src="/pic/profile_images%2F1393321742576279555%2FNzxmXVA__bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/JulianVoeg" title="Julian-Ferdinand">Julian-Ferdinand</a>
                        <a class="username" href="/JulianVoeg" title="@JulianVoeg">@JulianVoeg</a>
                      </div>
                      <span class="tweet-date"><a href="/JulianVoeg/status/1527238698349346818#m" title="May 19, 2022 · 10:44 AM UTC">22h</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/inversecos">@inversecos</a></div>
                <div class="tweet-content media-body" dir="auto">Really helpful. Thanks!</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span></div></span>
                </div>
              </div>
            </div></div>
          <div class="reply thread thread-line"><div class="timeline-item thread-last ">
              <a class="tweet-link" href="/Linux_Watcher/status/1527250841283047425#m"></a>
              <div class="tweet-body">
                <div><div class="tweet-header">
                    <a class="tweet-avatar" href="/Linux_Watcher"><img class="avatar round" src="/pic/profile_images%2F1523385879103954952%2Fq-wgGl3b_bigger.jpg" alt="" /></a>
                    <div class="tweet-name-row">
                      <div class="fullname-and-username">
                        <a class="fullname" href="/Linux_Watcher" title="Linux Watcher">Linux Watcher</a>
                        <a class="username" href="/Linux_Watcher" title="@Linux_Watcher">@Linux_Watcher</a>
                      </div>
                      <span class="tweet-date"><a href="/Linux_Watcher/status/1527250841283047425#m" title="May 19, 2022 · 11:32 AM UTC">22h</a></span>
                    </div>
                  </div></div>
                <div class="replying-to">Replying to <a href="/inversecos">@inversecos</a></div>
                <div class="tweet-content media-body" dir="auto">What's the delivery method used?</div>
                <div class="tweet-stats">
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-comment" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-retweet" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-quote" title=""></span></div></span>
                  <span class="tweet-stat"><div class="icon-container"><span class="icon-heart" title=""></span></div></span>
                </div>
              </div>
            </div></div>
          <div class="show-more"><a href="?cursor=LBlmgMC%2Bhfv72LEqgsC92Yyj8bEqhIC%2B5aTg67EqgoDSuazw1LEqgMCyydrO6rEqiICwjZjc37EqJQISAAA%3D#r">Load more</a></div>
        </div>
        <div class="top-ref"><div class="icon-container"><a class="icon-down" title="" href="#m"></a></div></div>
      </div></div>
  </body>
</html>